yeelight-pro-app-builder
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The builder tool and generated bridge components interact with a local
yeelight-homebinary using thenode:child_processspawnmethod (as seen inscripts/lib/command-runner.mjsandscripts/lib/templates/project-runtime.mjs). This implementation avoids shell execution risks by passing configuration and control data through standard input. - [COMMAND_EXECUTION]: Automated validation scripts (e.g.,
scripts/validate-automation-slice.mjs) use standard system tools includinggofor compilation of the runtime binary andnpmfor managing project dependencies in generated workspaces. - [EXTERNAL_DOWNLOADS]: Documentation and preview assets for the design system (e.g.,
assets/design-system/yeelight-pro/components/actions/actions.card.html) fetch React and ReactDOM from the unpkg.com CDN. This is a well-known service used for providing interactive examples in web-based documentation.
Audit Metadata